What Is the Safest Free Email Provider in the UK?
A few months back, my mum rang me in a bit of a panic. She'd got an email that "looked exactly like it was from her bank," telling her to confirm her details or her account would be frozen. She nearly clicked it. She didn't, thank god, but it shook her up enough that she asked me a question I genuinely had to sit down and think about: "What email should I even be using? Is Gmail safe?"
I'd never really questioned it before. I'd had the same Gmail account since secondary school. But once I started actually digging into how these free email providers handle your data, who can read your emails, and what happens when something goes wrong, I realized most of us are using whatever email we signed up for at 14 and never thinking about it again.
So I spent a good chunk of a few weekends testing this properly. I made fresh accounts on the big-name "private" providers, used them as my actual inbox for a while, dug through their privacy policies (yes, actually read them, not just skimmed), and tried to break things to see what would happen. This is what I found, written the way I'd explain it to a mate over a coffee, not the way a press release would.
Why "Free Email" Isn't Really Free
Here's the thing nobody tells you when you sign up for a free Gmail or Outlook account: you're still paying. Just not with money.
Gmail scans your inbox to build an advertising profile of you. It's not reading your emails like a person would, but algorithms are picking through your messages to figure out what ads to show you, what you might buy next, what you're interested in. Google's gotten better about not using this for ad targeting directly in recent years, but the scanning infrastructure is still there, and the data still feeds into the wider Google ecosystem.
That's not necessarily "unsafe" in the sense of hackers getting in. Gmail's actual security (two-factor authentication, spam filtering, breach detection) is genuinely solid. But "safe from hackers" and "private from the company itself" are two completely different things, and most people conflate them.
When my mum asked "is it safe," she meant both. So let's split this properly.
The Two Kinds of "Safe" You Actually Need
When I was testing providers, I kept two separate checklists running:
Security – can someone break into your account, intercept your emails, or trick you into handing over your password?
Privacy – can the company itself read your emails, sell your data, or hand it over to advertisers and governments without much resistance?
A provider can score brilliantly on one and poorly on the other. Gmail, for example, is excellent on security (Google's spam and phishing detection caught nearly everything I threw at it during testing) but weaker on privacy, simply because of how the business model works.
What I Actually Tested
I set up accounts on five providers and used each one for real emails, newsletters, and a few test "phishing" style messages I sent myself from a second account, just to see how the spam filters reacted:
- Gmail
- Outlook.com (Microsoft)
- Proton Mail
- Tuta (formerly Tutanota)
- Zoho Mail
I also looked at iCloud Mail and Yahoo briefly but didn't run them as a full inbox since they're either platform-locked (Apple) or have had a rough security history (Yahoo's old breaches still linger in people's minds, fairly or not).
Proton Mail: The One I Ended Up Trusting Most
I'll be honest, I went in expecting Proton Mail to be overhyped. Privacy YouTubers go on about it constantly, and that always makes me a bit suspicious. But after using it properly, it earned the recommendation.
Proton is based in Switzerland, which has stricter privacy laws than the UK or US. It's open source and has been independently audited for security, which provides further peace of mind. The bit that actually matters in plain English: your emails are encrypted on your device before they ever touch Proton's servers. Even if someone hacked Proton tomorrow, or police turned up with a court order, there's nothing readable to hand over. Your messages are encrypted before they touch Proton's servers in Geneva, and Proton cannot read them, not because of a privacy policy, but because of the way the encryption works.
The free plan is genuinely free, no credit card needed, no trial period that quietly turns into a charge. But it's tight. You get 1 GB of storage, one email address, no custom domain, and a 150 messages per day sending cap. If you're using it as a secondary, "this is the email I actually care about protecting" account, it's perfect. If you're trying to make it your one and only inbox for everything including newsletters and online shopping, you'll hit that storage wall faster than you'd think.
One thing I didn't expect: because Proton doesn't sell ads or harvest your data, the free plan is funded entirely by people who pay for the upgraded versions. That actually made me trust it more, not less. There's no hidden catch where "free" means "we make money off you somewhere else."
Quick honest downside: if you email a lot of people who use regular Gmail or Outlook, the full encryption magic only really kicks in when both people are on Proton, or you use their password-protected email option for outside recipients. It's a small extra step, not a dealbreaker, but worth knowing before you switch your whole life over.
Tuta: The Quietly Impressive Underdog
Tuta doesn't get talked about as much, but it deserves more attention than it gets. It's German, also open source, and its encryption coverage of content, subject lines, and attachments is particularly thorough for privacy-conscious users wanting to avoid trackers.
What surprised me using it day to day: even the subject lines are encrypted, which a lot of "secure" email providers don't bother with. Most encrypt the body of the email but leave the subject line sitting there in plain text, which always struck me as a bit of an odd gap once I noticed it.
Tuta uses a newer encryption system called TutaCrypt, which combines quantum-resistant methods with traditional ones, meaning it's built with future hacking techniques in mind, not just today's. That sounds like overkill for the average person checking their emails on the bus, and honestly, it kind of is. But I'd rather a provider over-engineer this stuff than under-engineer it.
The interface felt a touch less polished than Proton's when I was testing it, a little clunkier moving between folders, but nothing that actually got in the way of using it.
Zoho Mail: The One Nobody Mentions But Probably Should
This one genuinely surprised me. Zoho doesn't have the privacy-community hype that Proton and Tuta get, but it's been quietly doing free, ad-light email for years, mainly aimed at small businesses and freelancers.
It includes solid anti-spam and antivirus protection alongside encryption, without leaning on your data to make money. I used it for about three weeks as a secondary inbox for freelance client work, and the spam filtering was honestly better than I expected. Caught everything I threw at it.
It's not end-to-end encrypted in the same zero-knowledge way Proton and Tuta are, so I wouldn't put it in the "maximum privacy" category. But for someone who just wants a clean, professional, ad-free inbox without diving into the more technical privacy-tool world, it's a sensible middle ground.
Where Gmail and Outlook Actually Land
I'm not going to pretend Gmail and Outlook are dangerous, because they're not, in the hacking sense. Google and Microsoft both pour serious money into security, two-factor authentication, login alerts, breach monitoring, the lot. If your main worry is "will someone steal my password and get into my account," both are genuinely strong.
Where they fall down is the privacy side. Your data feeds into a much bigger advertising and data ecosystem, even with personalisation settings turned off. Turning off ad personalisation doesn't actually change the underlying data flows or which company has access to your information. That's just how the business works.
So my honest take: if you're a UK user mainly worried about scams, hacking, and account takeovers, Gmail and Outlook are fine, keep using them, just turn on two-factor authentication properly (more on that below). If you're worried about who's reading your stuff and what happens to your data long term, that's when Proton or Tuta start to make real sense.
Step-by-Step: How I'd Actually Set This Up
If you're reading this thinking "alright, I want to actually do something about this," here's the process I'd follow, based on what worked for me.
Step 1: Don't delete your old email yet. This was my first mistake. I got excited and almost deactivated my old Gmail before checking what was still linked to it. Banks, subscriptions, work logins, old forums you forgot existed, all of it can be tied to that address. Keep it alive as a backup for now.
Step 2: Sign up for Proton Mail (or Tuta) as a fresh account. No credit card needed for the free tier on either. Takes about five minutes.
Step 3: Set it up properly to get the full free storage. This caught me out. Proton's free plan only gives you the full 1 GB on Mail and 5 GB on Drive once you complete a few quick setup actions like adding a recovery method. Skip this step and you're stuck with less storage than you think you have.
Step 4: Slowly migrate the important stuff first. Start with your bank, your main subscriptions, anything sensitive. Don't try to move everything in one go, you'll just get overwhelmed and give up halfway through, which is exactly what happened to me the first time I tried this back in 2023.
Step 5: Set up an auto-forward or auto-reply on your old account telling people your new address, for a transition period of a month or two.
Step 6: Turn on two-factor authentication everywhere, old account and new. This matters more than which provider you choose, honestly. A weak password with no 2FA on Proton is still more vulnerable than a strong, 2FA-protected Gmail account.
Mistakes I'd Tell You to Avoid
Don't switch everything overnight. I tried this and ended up locked out of a delivery tracking page because the confirmation email went to my new inbox, but my old saved login still pointed to the old one. Small annoyance, but multiply that by twenty accounts and it's a genuine headache.
Don't assume "encrypted" means "untraceable." Even with Proton or Tuta, your IP address and metadata (who you emailed, when) can still exist in logs depending on settings. Full anonymity is a different, more complicated topic than just "safe email."
Don't ignore the storage limits and then panic later. I had a client send me a large attachment on my Proton free account and got an error message because I was sitting right at the 1 GB ceiling without realising it. Keep an eye on it, or be ready to delete old stuff occasionally.
Don't fall for "free trial" privacy apps that quietly auto-renew. This isn't about the providers above, all genuinely have honest free tiers, but plenty of copycat "secure email" apps out there use a free trial as a trap. Read the fine print before entering card details anywhere.
So, What's Actually the Safest?
If I had to give my mum one straight answer (and I eventually did), it's this: Proton Mail for most people who want real privacy without a steep learning curve, Tuta if you want even tighter encryption and don't mind a slightly less polished interface, and Zoho Mail if you mainly want a clean, professional, ad-free inbox without diving deep into the privacy-tool world.
Gmail and Outlook aren't dangerous, they're just not private, and there's a real difference between the two.
What actually changed for me after all this testing wasn't dramatic. I didn't get hacked using Gmail, nothing went wrong. But I sleep slightly easier knowing my main inbox isn't being quietly read by an algorithm somewhere, and my mum, after I helped her set up Proton on her phone, stopped panicking every time an email looked slightly off. That alone made the whole weekend of testing worth it.
If you're on the fence, just try the free tier of Proton or Tuta alongside your existing email for a couple of weeks. No commitment, no cost, and you'll know within a few days whether it fits how you actually use email.
